CVE Feed

    Dashboard / CVE / CVE-2026-72541

    CVE-2026-72541

    A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding delete_resource_type endpoint enforces. An attacker with workspace member privileges can corrupt resource type definitions, breaking workflows that depend on them.

    Published:Aug 11, 2026
    Last Modified:Aug 11, 2026
    EPS:Aug 11, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Windmill-labs
    Product
    Windmill

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-54136 (CVSS 5.1) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Pri…
    CVE-2026-72542 (CVSS 5.4) — A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators…
    CVE-2026-72539 (CVSS 6.5) — An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated wor…
    CVE-2026-47107 (CVSS 8.6) — Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configurat…
    CVE-2026-22683 (CVSS 8.7) — Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with …
    CVE-2026-33881 (CVSS 7.3) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Wor…
    CVE-2026-29059 (CVSS 6.9) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Pri…
    CVE-2026-26964 (CVSS 2.7) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Ver…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High